So why did the original warning put out by the PHP team say that the exploit didn't rely on the application code and simply having software like Apache mod_php running would be enough?
https://www.php.net/archive/2026.php#2026-10-21-5